/*      */ package com.zimbra.qa.unittest.prov.ldap;
/*      */ 
/*      */ import com.google.common.collect.Lists;
/*      */ import com.google.common.collect.Maps;
/*      */ import com.google.common.collect.Sets;
/*      */ import com.zimbra.common.account.Key.DistributionListBy;
/*      */ import com.zimbra.common.account.Key.DomainBy;
/*      */ import com.zimbra.common.service.ServiceException;
/*      */ import com.zimbra.cs.account.AccessManager;
/*      */ import com.zimbra.cs.account.Account;
/*      */ import com.zimbra.cs.account.AlwaysOnCluster;
/*      */ import com.zimbra.cs.account.AuthToken;
/*      */ import com.zimbra.cs.account.CalendarResource;
/*      */ import com.zimbra.cs.account.Config;
/*      */ import com.zimbra.cs.account.Cos;
/*      */ import com.zimbra.cs.account.DistributionList;
/*      */ import com.zimbra.cs.account.Domain;
/*      */ import com.zimbra.cs.account.DynamicGroup;
/*      */ import com.zimbra.cs.account.Entry;
/*      */ import com.zimbra.cs.account.GlobalGrant;
/*      */ import com.zimbra.cs.account.Group;
/*      */ import com.zimbra.cs.account.GuestAccount;
/*      */ import com.zimbra.cs.account.NamedEntry;
/*      */ import com.zimbra.cs.account.Provisioning;
/*      */ import com.zimbra.cs.account.Server;
/*      */ import com.zimbra.cs.account.UCService;
/*      */ import com.zimbra.cs.account.Zimlet;
/*      */ import com.zimbra.cs.account.accesscontrol.AttrRight;
/*      */ import com.zimbra.cs.account.accesscontrol.CheckRight;
/*      */ import com.zimbra.cs.account.accesscontrol.ComboRight;
/*      */ import com.zimbra.cs.account.accesscontrol.GranteeType;
/*      */ import com.zimbra.cs.account.accesscontrol.PresetRight;
/*      */ import com.zimbra.cs.account.accesscontrol.Right;
/*      */ import com.zimbra.cs.account.accesscontrol.Right.RightType;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.ACE;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.AllEffectiveRights;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.DomainedRightsByTargetType;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.EffectiveRights;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.Grants;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.RightAggregation;
/*      */ import com.zimbra.cs.account.accesscontrol.RightCommand.RightsByTargetType;
/*      */ import com.zimbra.cs.account.accesscontrol.Rights.Admin;
/*      */ import com.zimbra.cs.account.accesscontrol.TargetType;
/*      */ import com.zimbra.cs.account.accesscontrol.UserRight;
/*      */ import com.zimbra.cs.account.auth.AuthMechanism.AuthMech;
/*      */ import com.zimbra.cs.account.ldap.LdapProv;
/*      */ import com.zimbra.cs.account.ldap.entry.LdapDomain;
/*      */ import com.zimbra.qa.unittest.prov.ProvTest.SkipTestReason;
/*      */ import com.zimbra.soap.admin.type.GranteeSelector.GranteeBy;
/*      */ import com.zimbra.soap.type.TargetBy;
/*      */ import java.io.PrintStream;
/*      */ import java.util.ArrayList;
/*      */ import java.util.Collections;
/*      */ import java.util.HashMap;
/*      */ import java.util.Iterator;
/*      */ import java.util.List;
/*      */ import java.util.Map;
/*      */ import java.util.Set;
/*      */ import java.util.SortedMap;
/*      */ import org.junit.AfterClass;
/*      */ import org.junit.Assert;
/*      */ import org.junit.BeforeClass;
/*      */ import org.junit.Test;
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ public class TestACLAll
/*      */   extends LdapTest
/*      */ {
/*      */   private static final String ATTR_ALLOWED_IN_THE_RIGHT = "description";
/*      */   private static final String ATTR_NOTALLOWED_IN_THE_RIGHT = "objectClass";
/*      */   private static final String PASSWORD = "test123";
/*   91 */   private static int sequence = 1;
/*      */   
/*   93 */   private static List<Right> rights = Lists.newArrayList();
/*      */   
/*      */   private static class TestGranteeType {
/*   96 */     private static final TestGranteeType GRANTEE_DYNAMIC_GROUP = new TestGranteeType("dgp");
/*   97 */     private static final List<TestGranteeType> TEST_GRANTEE_TYPES = Lists.newArrayList();
/*      */     private final Object granteeType;
/*      */     
/*  100 */     static { TEST_GRANTEE_TYPES.add(GRANTEE_DYNAMIC_GROUP);
/*  101 */       for (GranteeType granteeType : GranteeType.values()) {
/*  102 */         TEST_GRANTEE_TYPES.add(new TestGranteeType(granteeType));
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */     static TestGranteeType get(GranteeType gt)
/*      */     {
/*  109 */       for (TestGranteeType testGranteeType : TEST_GRANTEE_TYPES) {
/*  110 */         Object granteeType = testGranteeType.getGranteeType();
/*  111 */         if (gt == granteeType) {
/*  112 */           return testGranteeType;
/*      */         }
/*      */       }
/*  115 */       Assert.fail();
/*  116 */       return null;
/*      */     }
/*      */     
/*      */     private TestGranteeType(Object granteeType) {
/*  120 */       this.granteeType = granteeType;
/*      */     }
/*      */     
/*      */     private Object getGranteeType() {
/*  124 */       return this.granteeType;
/*      */     }
/*      */     
/*      */     private String getCode() {
/*  128 */       if ((this.granteeType instanceof GranteeType)) {
/*  129 */         return ((GranteeType)this.granteeType).getCode();
/*      */       }
/*  131 */       return this.granteeType.toString();
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*  136 */   static final AccessManager accessMgr = AccessManager.getInstance();
/*      */   private static LdapProvTestUtil provUtil;
/*      */   private static LdapProv prov;
/*      */   private static Domain baseDomain;
/*      */   private static String BASE_DOMAIN_NAME;
/*      */   private static Account globalAdmin;
/*      */   
/*      */   @BeforeClass
/*      */   public static void init() throws Exception
/*      */   {
/*  146 */     provUtil = new LdapProvTestUtil();
/*  147 */     prov = provUtil.getProv();
/*  148 */     baseDomain = provUtil.createDomain(baseDomainName());
/*  149 */     BASE_DOMAIN_NAME = baseDomain.getName();
/*  150 */     globalAdmin = provUtil.createGlobalAdmin("globaladmin", baseDomain);
/*      */     
/*  152 */     ACLTestUtil.initTestRights();
/*  153 */     initRights();
/*      */     
/*      */ 
/*  156 */     revokeAllGrantsOnGlobalGrantAndGlobalConfig();
/*      */   }
/*      */   
/*      */   @AfterClass
/*      */   public static void cleanup() throws Exception
/*      */   {
/*  162 */     revokeAllGrantsOnGlobalGrantAndGlobalConfig();
/*  163 */     Cleanup.deleteAll(new String[] { baseDomainName() });
/*      */   }
/*      */   
/*      */   private static void initRights() throws Exception
/*      */   {
/*  168 */     rights.add(ACLTestUtil.USER_LOGIN_AS);
/*  169 */     rights.add(ACLTestUtil.USER_RIGHT);
/*  170 */     rights.add(ACLTestUtil.USER_RIGHT_DISTRIBUTION_LIST);
/*  171 */     rights.add(ACLTestUtil.USER_RIGHT_DOMAIN);
/*  172 */     rights.add(ACLTestUtil.USER_RIGHT_RESTRICTED_GRANT_TARGET_TYPE);
/*      */     
/*  174 */     rights.add(ACLTestUtil.ADMIN_PRESET_LOGIN_AS);
/*  175 */     rights.add(ACLTestUtil.ADMIN_PRESET_ACCOUNT);
/*  176 */     rights.add(ACLTestUtil.ADMIN_PRESET_CALENDAR_RESOURCE);
/*  177 */     rights.add(ACLTestUtil.ADMIN_PRESET_CONFIG);
/*  178 */     rights.add(ACLTestUtil.ADMIN_PRESET_COS);
/*  179 */     rights.add(ACLTestUtil.ADMIN_PRESET_DISTRIBUTION_LIST);
/*  180 */     rights.add(ACLTestUtil.ADMIN_PRESET_DYNAMIC_GROUP);
/*  181 */     rights.add(ACLTestUtil.ADMIN_PRESET_DOMAIN);
/*  182 */     rights.add(ACLTestUtil.ADMIN_PRESET_GLOBALGRANT);
/*  183 */     rights.add(ACLTestUtil.ADMIN_PRESET_SERVER);
/*  184 */     rights.add(ACLTestUtil.ADMIN_PRESET_UC_SERVICE);
/*  185 */     rights.add(ACLTestUtil.ADMIN_PRESET_XMPP_COMPONENT);
/*  186 */     rights.add(ACLTestUtil.ADMIN_PRESET_ZIMLET);
/*      */     
/*  188 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_ACCOUNT);
/*  189 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_ACCOUNT);
/*  190 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_ACCOUNT);
/*  191 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_ACCOUNT);
/*  192 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_CALENDAR_RESOURCE);
/*  193 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_CALENDAR_RESOURCE);
/*  194 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_CALENDAR_RESOURCE);
/*  195 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_CALENDAR_RESOURCE);
/*  196 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_CONFIG);
/*  197 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_CONFIG);
/*  198 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_CONFIG);
/*  199 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_CONFIG);
/*  200 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_COS);
/*  201 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_COS);
/*  202 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_COS);
/*  203 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_COS);
/*  204 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_DISTRIBUTION_LIST);
/*  205 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_DISTRIBUTION_LIST);
/*  206 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_DISTRIBUTION_LIST);
/*  207 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_DISTRIBUTION_LIST);
/*  208 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_DYNAMIC_GROUP);
/*  209 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_DYNAMIC_GROUP);
/*  210 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_DYNAMIC_GROUP);
/*  211 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_DYNAMIC_GROUP);
/*  212 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_DOMAIN);
/*  213 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_DOMAIN);
/*  214 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_DOMAIN);
/*  215 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_DOMAIN);
/*  216 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_SERVER);
/*  217 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_SERVER);
/*  218 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_SERVER);
/*  219 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_SERVER);
/*  220 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_UC_SERVICE);
/*  221 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_UC_SERVICE);
/*  222 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_UC_SERVICE);
/*  223 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_UC_SERVICE);
/*  224 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETALL_ZIMLET);
/*  225 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETALL_ZIMLET);
/*  226 */     rights.add(ACLTestUtil.ADMIN_ATTR_GETSOME_ZIMLET);
/*  227 */     rights.add(ACLTestUtil.ADMIN_ATTR_SETSOME_ZIMLET);
/*      */     
/*  229 */     rights.add(ACLTestUtil.ADMIN_COMBO_ACCOUNT);
/*  230 */     rights.add(ACLTestUtil.ADMIN_COMBO_CALENDAR_RESOURCE);
/*  231 */     rights.add(ACLTestUtil.ADMIN_COMBO_CONFIG);
/*  232 */     rights.add(ACLTestUtil.ADMIN_COMBO_COS);
/*  233 */     rights.add(ACLTestUtil.ADMIN_COMBO_DISTRIBUTION_LIST);
/*  234 */     rights.add(ACLTestUtil.ADMIN_COMBO_DYNAMIC_GROUP);
/*  235 */     rights.add(ACLTestUtil.ADMIN_COMBO_DOMAIN);
/*  236 */     rights.add(ACLTestUtil.ADMIN_COMBO_GLOBALGRANT);
/*  237 */     rights.add(ACLTestUtil.ADMIN_COMBO_SERVER);
/*  238 */     rights.add(ACLTestUtil.ADMIN_COMBO_UC_SERVICE);
/*  239 */     rights.add(ACLTestUtil.ADMIN_COMBO_XMPP_COMPONENT);
/*  240 */     rights.add(ACLTestUtil.ADMIN_COMBO_ZIMLET);
/*      */   }
/*      */   
/*      */   private Config getConfig() throws Exception
/*      */   {
/*  245 */     return prov.getConfig();
/*      */   }
/*      */   
/*      */   private GlobalGrant getGlobalGrant() throws Exception {
/*  249 */     return prov.getGlobalGrant();
/*      */   }
/*      */   
/*      */ 
/*      */   private boolean asAdmin(Account acct)
/*      */   {
/*  255 */     return (acct.isIsAdminAccount()) || (acct.isIsDelegatedAdminAccount());
/*      */   }
/*      */   
/*      */   private static synchronized String nextSeq() {
/*  259 */     return "" + sequence++;
/*      */   }
/*      */   
/*      */   private String domainName() {
/*  263 */     return nextSeq() + "." + BASE_DOMAIN_NAME;
/*      */   }
/*      */   
/*      */   private String accountName() {
/*  267 */     return "acct-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String calendarResourceName() {
/*  271 */     return "cr-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String distributionListName() {
/*  275 */     return "dl-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String dynamicGroupName() {
/*  279 */     return "group-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String cosName() {
/*  283 */     return "cos-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String serverName() {
/*  287 */     return "server-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String alwaysOnClusterName() {
/*  291 */     return "alwaysOnCluster-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String ucServiceName() {
/*  295 */     return "ucservice-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String XMPPComponentName() {
/*  299 */     return "xmpp-" + nextSeq();
/*      */   }
/*      */   
/*      */   private String zimletName() {
/*  303 */     return "zimlet-" + nextSeq();
/*      */   }
/*      */   
/*      */   private Domain createDomain() throws Exception {
/*  307 */     return provUtil.createDomain(domainName());
/*      */   }
/*      */   
/*      */   private Account anonAccount() {
/*  311 */     return GuestAccount.ANONYMOUS_ACCT;
/*      */   }
/*      */   
/*      */   private Account createUserAccount(String localpart, Domain domain) throws Exception {
/*  315 */     if (domain == null) {
/*  316 */       domain = createDomain();
/*      */     }
/*  318 */     return provUtil.createAccount(localpart, domain);
/*      */   }
/*      */   
/*      */   private Account createUserAccount(Domain domain) throws Exception {
/*  322 */     String localpart = accountName();
/*  323 */     return createUserAccount(localpart, domain);
/*      */   }
/*      */   
/*      */   private Account createDelegatedAdminAccount(String localpart, Domain domain) throws Exception
/*      */   {
/*  328 */     if (domain == null) {
/*  329 */       domain = createDomain();
/*      */     }
/*  331 */     return provUtil.createDelegatedAdmin(localpart, domain);
/*      */   }
/*      */   
/*      */   private Account createDelegatedAdminAccount(Domain domain) throws Exception {
/*  335 */     String localpart = accountName();
/*  336 */     return createDelegatedAdminAccount(localpart, domain);
/*      */   }
/*      */   
/*      */   private Account createGuestAccount(String email, String password) {
/*  340 */     return new GuestAccount(email, password);
/*      */   }
/*      */   
/*      */   private Account createKeyAccount(String name, String accesKey) {
/*  344 */     AuthToken authToken = new ACLTestUtil.KeyAuthToken(name, accesKey);
/*  345 */     return new GuestAccount(authToken);
/*      */   }
/*      */   
/*      */   private CalendarResource createCalendarResource(String localpart, Domain domain) throws Exception
/*      */   {
/*  350 */     if (domain == null) {
/*  351 */       domain = createDomain();
/*      */     }
/*      */     
/*  354 */     Map<String, Object> attrs = new HashMap();
/*  355 */     attrs.put("displayName", localpart);
/*  356 */     attrs.put("zimbraCalResType", "Equipment");
/*      */     
/*  358 */     return provUtil.createCalendarResource(localpart, domain, attrs);
/*      */   }
/*      */   
/*      */   private CalendarResource createCalendarResource(Domain domain) throws Exception {
/*  362 */     String localpart = calendarResourceName();
/*  363 */     return createCalendarResource(localpart, domain);
/*      */   }
/*      */   
/*      */   private DistributionList createDistributionList(String localpart, Domain domain, Map<String, Object> attrs) throws Exception
/*      */   {
/*  368 */     if (domain == null) {
/*  369 */       domain = createDomain();
/*      */     }
/*  371 */     return provUtil.createDistributionList(localpart, domain, attrs);
/*      */   }
/*      */   
/*      */   private DistributionList createUserDistributionList(String localpart, Domain domain) throws Exception
/*      */   {
/*  376 */     return createDistributionList(localpart, domain, new HashMap());
/*      */   }
/*      */   
/*      */   private DistributionList createUserDistributionList(Domain domain) throws Exception {
/*  380 */     String localpart = distributionListName();
/*  381 */     return createUserDistributionList(localpart, domain);
/*      */   }
/*      */   
/*      */   private DistributionList createAdminDistributionList(String localpart, Domain domain) throws Exception
/*      */   {
/*  386 */     Map<String, Object> attrs = new HashMap();
/*  387 */     attrs.put("zimbraIsAdminGroup", "TRUE");
/*  388 */     return createDistributionList(localpart, domain, attrs);
/*      */   }
/*      */   
/*      */   private DistributionList createAdminDistributionList(Domain domain) throws Exception {
/*  392 */     String localpart = distributionListName();
/*  393 */     return createAdminDistributionList(localpart, domain);
/*      */   }
/*      */   
/*      */   private DynamicGroup createDynamicGroup(String localpart, Domain domain, Map<String, Object> attrs)
/*      */     throws Exception
/*      */   {
/*  399 */     if (domain == null) {
/*  400 */       domain = createDomain();
/*      */     }
/*  402 */     return provUtil.createDynamicGroup(localpart, domain, attrs);
/*      */   }
/*      */   
/*      */   private DynamicGroup createUserDynamicGroup(String localpart, Domain domain) throws Exception
/*      */   {
/*  407 */     return createDynamicGroup(localpart, domain, new HashMap());
/*      */   }
/*      */   
/*      */   private DynamicGroup createUserDynamicGroup(Domain domain) throws Exception {
/*  411 */     String localpart = dynamicGroupName();
/*  412 */     return createUserDynamicGroup(localpart, domain);
/*      */   }
/*      */   
/*      */   private DynamicGroup createAdminDynamicGroup(String localpart, Domain domain) throws Exception
/*      */   {
/*  417 */     Map<String, Object> attrs = new HashMap();
/*  418 */     attrs.put("zimbraIsAdminGroup", "TRUE");
/*  419 */     return createDynamicGroup(localpart, domain, attrs);
/*      */   }
/*      */   
/*      */   private DynamicGroup createAdminDynamicGroup(Domain domain) throws Exception {
/*  423 */     String localpart = dynamicGroupName();
/*  424 */     return createAdminDynamicGroup(localpart, domain);
/*      */   }
/*      */   
/*      */   private Cos createCos() throws Exception {
/*  428 */     return provUtil.createCos(cosName());
/*      */   }
/*      */   
/*      */   private Server createServer() throws Exception {
/*  432 */     return provUtil.createServer(serverName());
/*      */   }
/*      */   
/*      */   private AlwaysOnCluster createAlwaysOnCluster() throws Exception {
/*  436 */     return provUtil.createAlwaysOnCluster(alwaysOnClusterName());
/*      */   }
/*      */   
/*      */   private UCService createUCService() throws Exception {
/*  440 */     return provUtil.createUCService(ucServiceName());
/*      */   }
/*      */   
/*      */   private Zimlet createZimlet() throws Exception {
/*  444 */     Map<String, Object> attrs = new HashMap();
/*  445 */     attrs.put("zimbraZimletVersion", "1.0");
/*  446 */     return provUtil.createZimlet(zimletName(), attrs);
/*      */   }
/*      */   
/*      */ 
/*      */   private boolean expectedIsUserRightGrantableOnTargetType(UserRight userRight, TargetType targetType)
/*      */     throws Exception
/*      */   {
/*  453 */     TargetType rightTarget = userRight.getTargetType();
/*  454 */     TargetType rightGrantTarget = userRight.getGrantTargetType();
/*      */     
/*  456 */     switch (rightTarget) {
/*      */     case account: 
/*  458 */       if (rightGrantTarget == null) {
/*  459 */         return (targetType == TargetType.account) || (targetType == TargetType.calresource) || (targetType == TargetType.dl) || (targetType == TargetType.group) || (targetType == TargetType.domain) || (targetType == TargetType.global);
/*      */       }
/*      */       
/*      */ 
/*      */ 
/*      */ 
/*  465 */       if (rightGrantTarget == TargetType.account) {
/*  466 */         return (targetType == TargetType.account) || (targetType == TargetType.calresource);
/*      */       }
/*  468 */       if (rightGrantTarget == TargetType.dl) {
/*  469 */         return (targetType == TargetType.dl) || (targetType == TargetType.group);
/*      */       }
/*  471 */       if (rightGrantTarget == TargetType.domain)
/*  472 */         return targetType == TargetType.domain;
/*  473 */       if (rightGrantTarget == TargetType.global) {
/*  474 */         return targetType == TargetType.global;
/*      */       }
/*  476 */       return false;
/*      */     
/*      */     case calresource: 
/*  479 */       Assert.fail();
/*      */     case cos: 
/*  481 */       Assert.fail();
/*      */     case dl: 
/*  483 */       if (rightGrantTarget == null) {
/*  484 */         return (targetType == TargetType.dl) || (targetType == TargetType.group) || (targetType == TargetType.domain) || (targetType == TargetType.global);
/*      */       }
/*      */       
/*      */ 
/*  488 */       if (rightGrantTarget == TargetType.dl) {
/*  489 */         return (targetType == TargetType.dl) || (targetType == TargetType.group);
/*      */       }
/*  491 */       if (rightGrantTarget == TargetType.domain)
/*  492 */         return targetType == TargetType.domain;
/*  493 */       if (rightGrantTarget == TargetType.global) {
/*  494 */         return targetType == TargetType.global;
/*      */       }
/*  496 */       return false;
/*      */     
/*      */     case domain: 
/*  499 */       if (rightGrantTarget == null) {
/*  500 */         return (targetType == TargetType.domain) || (targetType == TargetType.global);
/*      */       }
/*  502 */       if (rightGrantTarget == TargetType.global) {
/*  503 */         return targetType == TargetType.global;
/*      */       }
/*  505 */       return false;
/*      */     }
/*      */     
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  516 */     Assert.fail();
/*      */     
/*  518 */     return false;
/*      */   }
/*      */   
/*      */   private void collectGrantableTargetTypes(TargetType rightTarget, Set<TargetType> validTypes) {
/*  522 */     switch (rightTarget) {
/*      */     case account: 
/*  524 */       validTypes.add(TargetType.account);
/*  525 */       validTypes.add(TargetType.dl);
/*  526 */       validTypes.add(TargetType.group);
/*  527 */       validTypes.add(TargetType.domain);
/*  528 */       validTypes.add(TargetType.global);
/*  529 */       break;
/*      */     case calresource: 
/*  531 */       validTypes.add(TargetType.calresource);
/*  532 */       validTypes.add(TargetType.dl);
/*  533 */       validTypes.add(TargetType.group);
/*  534 */       validTypes.add(TargetType.domain);
/*  535 */       validTypes.add(TargetType.global);
/*  536 */       break;
/*      */     case cos: 
/*  538 */       validTypes.add(TargetType.cos);
/*  539 */       validTypes.add(TargetType.global);
/*  540 */       break;
/*      */     case dl: 
/*  542 */       validTypes.add(TargetType.dl);
/*  543 */       validTypes.add(TargetType.domain);
/*  544 */       validTypes.add(TargetType.global);
/*  545 */       break;
/*      */     case group: 
/*  547 */       validTypes.add(TargetType.group);
/*  548 */       validTypes.add(TargetType.domain);
/*  549 */       validTypes.add(TargetType.global);
/*  550 */       break;
/*      */     case domain: 
/*  552 */       validTypes.add(TargetType.domain);
/*  553 */       validTypes.add(TargetType.global);
/*  554 */       break;
/*      */     case server: 
/*  556 */       validTypes.add(TargetType.server);
/*  557 */       validTypes.add(TargetType.global);
/*  558 */       break;
/*      */     case alwaysoncluster: 
/*  560 */       validTypes.add(TargetType.alwaysoncluster);
/*  561 */       validTypes.add(TargetType.global);
/*  562 */       break;
/*      */     case ucservice: 
/*  564 */       validTypes.add(TargetType.ucservice);
/*  565 */       validTypes.add(TargetType.global);
/*  566 */       break;
/*      */     case xmppcomponent: 
/*  568 */       validTypes.add(TargetType.xmppcomponent);
/*  569 */       validTypes.add(TargetType.global);
/*  570 */       break;
/*      */     case zimlet: 
/*  572 */       validTypes.add(TargetType.zimlet);
/*  573 */       validTypes.add(TargetType.global);
/*  574 */       break;
/*      */     case config: 
/*  576 */       validTypes.add(TargetType.config);
/*  577 */       validTypes.add(TargetType.global);
/*  578 */       break;
/*      */     case global: 
/*  580 */       validTypes.add(TargetType.global);
/*  581 */       break;
/*      */     default: 
/*  583 */       Assert.fail();
/*      */     }
/*      */   }
/*      */   
/*      */   private boolean expectedIsPresetRightGrantableOnTargetType(PresetRight presetRight, TargetType targetType) throws Exception
/*      */   {
/*  589 */     Set<TargetType> validTypes = Sets.newHashSet();
/*  590 */     TargetType rightTarget = presetRight.getTargetType();
/*  591 */     collectGrantableTargetTypes(rightTarget, validTypes);
/*  592 */     return validTypes.contains(targetType);
/*      */   }
/*      */   
/*      */   private boolean expectedIsAttrRightGrantableOnTargetType(AttrRight attrRight, TargetType targetType) throws Exception
/*      */   {
/*  597 */     Set<TargetType> rightTargets = attrRight.getTargetTypes();
/*      */     
/*      */ 
/*      */ 
/*  601 */     Set<TargetType> validTypes = Sets.newHashSet();
/*  602 */     Iterator i$ = rightTargets.iterator(); if (i$.hasNext()) { TargetType rightTarget = (TargetType)i$.next();
/*  603 */       collectGrantableTargetTypes(rightTarget, validTypes);
/*  604 */       return validTypes.contains(targetType);
/*      */     }
/*  606 */     return false;
/*      */   }
/*      */   
/*      */   private boolean expectedIsComboRightGrantableOnTargetType(ComboRight comboRight, TargetType targetType) throws Exception
/*      */   {
/*  611 */     Set<Right> allRights = comboRight.getAllRights();
/*      */     
/*      */ 
/*  614 */     for (Right right : allRights) {
/*  615 */       if (!expectedIsRightGrantableOnTargetType(right, targetType)) {
/*  616 */         return false;
/*      */       }
/*      */     }
/*  619 */     return true;
/*      */   }
/*      */   
/*      */   private boolean expectedIsRightGrantableOnTargetType(Right right, TargetType targetType) throws Exception
/*      */   {
/*  624 */     if ((targetType.isGroup()) && (!CheckRight.allowGroupTarget(right))) {
/*  625 */       return false;
/*      */     }
/*  627 */     if (right.isUserRight())
/*  628 */       return expectedIsUserRightGrantableOnTargetType((UserRight)right, targetType);
/*  629 */     if (right.isPresetRight())
/*  630 */       return expectedIsPresetRightGrantableOnTargetType((PresetRight)right, targetType);
/*  631 */     if (right.isAttrRight())
/*  632 */       return expectedIsAttrRightGrantableOnTargetType((AttrRight)right, targetType);
/*  633 */     if (right.isComboRight()) {
/*  634 */       return expectedIsComboRightGrantableOnTargetType((ComboRight)right, targetType);
/*      */     }
/*  636 */     Assert.fail();
/*  637 */     return false;
/*      */   }
/*      */   
/*      */ 
/*      */   private void skipTest(String note, TargetType grantedOnTargetType, TestGranteeType testGranteeType, Right right)
/*      */     throws Exception
/*      */   {
/*  644 */     System.out.println("skipping test (" + note + "): " + "grant target=" + grantedOnTargetType.getCode() + ", grantee type=" + testGranteeType.getCode() + ", right=" + right.getName());
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private void execTest(String note, TargetType grantedOnTargetType, TestGranteeType testGranteeType, Right right)
/*      */     throws Exception
/*      */   {
/*  654 */     System.out.println("testing (" + note + "): " + "grant target=" + grantedOnTargetType.getCode() + ", grantee type=" + testGranteeType.getCode() + ", right=" + right.getName());
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  663 */     Domain domain = createDomain();
/*  664 */     boolean isUserRight = right.isUserRight();
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*  669 */     List<Account> allowedAccts = new ArrayList();
/*  670 */     List<Account> deniedAccts = new ArrayList();
/*  671 */     NamedEntry grantee = null;
/*  672 */     String granteeName = null;
/*  673 */     String secret = null;
/*      */     
/*  675 */     Object gt = testGranteeType.getGranteeType();
/*      */     
/*  677 */     GranteeType granteeType = null;
/*  678 */     if ((gt instanceof GranteeType)) {
/*  679 */       granteeType = (GranteeType)gt;
/*      */       
/*  681 */       switch (granteeType) {
/*      */       case GT_USER: 
/*  683 */         if (isUserRight) {
/*  684 */           grantee = createUserAccount(domain);
/*  685 */           allowedAccts.add((Account)grantee);
/*  686 */           deniedAccts.add(createUserAccount(domain));
/*      */         } else {
/*  688 */           grantee = createDelegatedAdminAccount(domain);
/*  689 */           allowedAccts.add((Account)grantee);
/*  690 */           deniedAccts.add(createDelegatedAdminAccount(domain));
/*      */         }
/*  692 */         granteeName = grantee.getName();
/*      */         
/*  694 */         break;
/*      */       case GT_GROUP: 
/*  696 */         if (isUserRight) {
/*  697 */           grantee = createUserDistributionList(domain);
/*  698 */           Account allowedAcct = createUserAccount(domain);
/*  699 */           allowedAccts.add(allowedAcct);
/*  700 */           prov.addMembers((DistributionList)grantee, new String[] { allowedAcct.getName() });
/*      */           
/*      */ 
/*  703 */           Account guestAcct = createGuestAccount("guest@guest.com", "test123");
/*  704 */           allowedAccts.add(guestAcct);
/*  705 */           prov.addMembers((DistributionList)grantee, new String[] { guestAcct.getName() });
/*      */           
/*  707 */           deniedAccts.add(createUserAccount(domain));
/*      */         } else {
/*  709 */           grantee = createAdminDistributionList(domain);
/*  710 */           Account allowedAcct = createDelegatedAdminAccount(domain);
/*  711 */           allowedAccts.add(allowedAcct);
/*  712 */           prov.addMembers((DistributionList)grantee, new String[] { allowedAcct.getName() });
/*  713 */           deniedAccts.add(createDelegatedAdminAccount(domain));
/*      */         }
/*  715 */         granteeName = grantee.getName();
/*  716 */         break;
/*      */       
/*      */       case GT_EXT_GROUP: 
/*  719 */         Domain extDomain = createDomain();
/*  720 */         String extDomainDN = ((LdapDomain)extDomain).getDN();
/*  721 */         String acctLocalpart = "acct-ext";
/*      */         
/*      */ 
/*      */ 
/*      */ 
/*  726 */         Map<String, Object> domainAttrs = Maps.newHashMap();
/*      */         
/*  728 */         if (isUserRight) {
/*  729 */           domain.setAuthMech(AuthMechanism.AuthMech.ad.name(), domainAttrs);
/*      */         } else {
/*  731 */           domain.setAuthMechAdmin(AuthMechanism.AuthMech.ad.name(), domainAttrs);
/*      */         }
/*      */         
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  757 */         domain.addAuthLdapURL("***", domainAttrs);
/*  758 */         domain.setAuthLdapSearchBindDn("***", domainAttrs);
/*  759 */         domain.setAuthLdapSearchBindPassword("***", domainAttrs);
/*  760 */         domain.setExternalGroupLdapSearchBase("OU=Engineering,DC=vmware,DC=com", domainAttrs);
/*  761 */         domain.setExternalGroupLdapSearchFilter("(&(objectClass=group)(mail=%n))", domainAttrs);
/*  762 */         domain.setExternalGroupHandlerClass("com.zimbra.cs.account.grouphandler.ADGroupHandler", domainAttrs);
/*  763 */         prov.modifyAttrs(domain, domainAttrs);
/*      */         
/*  765 */         String extGroupName = "ENG_pao_users_home4@vmware.com";
/*      */         
/*      */ 
/*  768 */         Account zimbraAcct = createDelegatedAdminAccount(acctLocalpart, domain);
/*  769 */         zimbraAcct.setAuthLdapExternalDn("CN=Phoebe Shao,OU=PAO_Users,OU=PaloAlto_California_USA,OU=NALA,OU=SITES,OU=Engineering,DC=vmware,DC=com");
/*  770 */         allowedAccts.add(zimbraAcct);
/*      */         
/*      */ 
/*  773 */         granteeName = domain.getName() + ":" + extGroupName;
/*  774 */         break;
/*      */       case GT_AUTHUSER: 
/*  776 */         if (isUserRight) {
/*  777 */           allowedAccts.add(createUserAccount("allowed-user-acct", domain));
/*  778 */           deniedAccts.add(createGuestAccount("not-my-guest@external.com", "test123"));
/*      */         } else {
/*  780 */           deniedAccts.add(createDelegatedAdminAccount("denied-da-acct", domain));
/*      */         }
/*  782 */         break;
/*      */       case GT_DOMAIN: 
/*  784 */         grantee = createDomain();
/*  785 */         if (isUserRight) {
/*  786 */           allowedAccts.add(createUserAccount("allowed-user-acct", (Domain)grantee));
/*  787 */           Domain notGrantee = createDomain();
/*  788 */           deniedAccts.add(createUserAccount("denied-user-acct", notGrantee));
/*      */         } else {
/*  790 */           deniedAccts.add(createDelegatedAdminAccount("denied-da-acct", (Domain)grantee));
/*      */         }
/*      */         
/*  793 */         granteeName = grantee.getName();
/*  794 */         break;
/*      */       case GT_GUEST: 
/*  796 */         granteeName = "be-my-guest@guest.com";
/*  797 */         secret = "test123";
/*  798 */         if (isUserRight) {
/*  799 */           allowedAccts.add(createGuestAccount(granteeName, secret));
/*  800 */           deniedAccts.add(createGuestAccount("not-my-guest@external.com", "bad"));
/*      */         } else {
/*  802 */           deniedAccts.add(createDelegatedAdminAccount("denied-da-acct", domain));
/*  803 */           deniedAccts.add(createGuestAccount(granteeName, secret));
/*      */         }
/*  805 */         break;
/*      */       case GT_KEY: 
/*  807 */         granteeName = "be-my-guest";
/*  808 */         secret = "test123";
/*  809 */         if (isUserRight) {
/*  810 */           allowedAccts.add(createKeyAccount(granteeName, secret));
/*  811 */           deniedAccts.add(createKeyAccount("not-my-guest", "bad"));
/*      */         } else {
/*  813 */           deniedAccts.add(createDelegatedAdminAccount("denied-da-acct", domain));
/*  814 */           deniedAccts.add(createKeyAccount(granteeName, secret));
/*      */         }
/*  816 */         break;
/*      */       case GT_PUBLIC: 
/*  818 */         if (isUserRight) {
/*  819 */           allowedAccts.add(anonAccount());
/*      */         } else {
/*  821 */           deniedAccts.add(anonAccount());
/*      */         }
/*  823 */         break;
/*      */       default: 
/*  825 */         Assert.fail();
/*      */       }
/*      */     }
/*      */     else {
/*  829 */       Assert.assertEquals(TestGranteeType.GRANTEE_DYNAMIC_GROUP, testGranteeType);
/*      */       
/*  831 */       granteeType = GranteeType.GT_GROUP;
/*      */       
/*  833 */       if (isUserRight) {
/*  834 */         grantee = createUserDynamicGroup(domain);
/*  835 */         Account allowedAcct = createUserAccount(domain);
/*  836 */         allowedAccts.add(allowedAcct);
/*  837 */         prov.addGroupMembers((DynamicGroup)grantee, new String[] { allowedAcct.getName() });
/*      */         
/*      */ 
/*  840 */         Account guestAcct = createGuestAccount("guest@guest.com", "test123");
/*  841 */         allowedAccts.add(guestAcct);
/*  842 */         prov.addGroupMembers((DynamicGroup)grantee, new String[] { guestAcct.getName() });
/*      */         
/*  844 */         deniedAccts.add(createUserAccount(domain));
/*      */       } else {
/*  846 */         grantee = createAdminDynamicGroup(domain);
/*  847 */         Account allowedAcct = createDelegatedAdminAccount(domain);
/*  848 */         allowedAccts.add(allowedAcct);
/*  849 */         prov.addGroupMembers((DynamicGroup)grantee, new String[] { allowedAcct.getName() });
/*  850 */         deniedAccts.add(createDelegatedAdminAccount(domain));
/*      */       }
/*  852 */       granteeName = grantee.getName();
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*  858 */     boolean expectInvalidRequest = false;
/*  859 */     if (isUserRight) {
/*  860 */       expectInvalidRequest = !expectedIsRightGrantableOnTargetType(right, grantedOnTargetType);
/*      */     }
/*      */     else
/*      */     {
/*  864 */       if (!granteeType.allowedForAdminRights()) {
/*  865 */         expectInvalidRequest = true;
/*      */       }
/*      */       
/*  868 */       if ((!expectInvalidRequest) && 
/*  869 */         (granteeType == GranteeType.GT_DOMAIN) && (right != Rights.Admin.R_crossDomainAdmin)) {
/*  870 */         expectInvalidRequest = true;
/*      */       }
/*      */       
/*      */ 
/*  874 */       if (!expectInvalidRequest) {
/*  875 */         expectInvalidRequest = !expectedIsRightGrantableOnTargetType(right, grantedOnTargetType);
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*  882 */     Entry grantedOnTarget = null;
/*  883 */     String targetName = null;
/*      */     
/*  885 */     switch (grantedOnTargetType) {
/*      */     case account: 
/*  887 */       grantedOnTarget = createUserAccount("target-acct", domain);
/*  888 */       targetName = ((Account)grantedOnTarget).getName();
/*  889 */       break;
/*      */     case calresource: 
/*  891 */       grantedOnTarget = createCalendarResource("target-cr", domain);
/*  892 */       targetName = ((CalendarResource)grantedOnTarget).getName();
/*  893 */       break;
/*      */     case cos: 
/*  895 */       grantedOnTarget = createCos();
/*  896 */       targetName = ((Cos)grantedOnTarget).getName();
/*  897 */       break;
/*      */     case dl: 
/*  899 */       grantedOnTarget = createUserDistributionList("target-distributionlist", domain);
/*  900 */       targetName = ((DistributionList)grantedOnTarget).getName();
/*  901 */       break;
/*      */     case group: 
/*  903 */       grantedOnTarget = createUserDynamicGroup("target-dynamicgroup", domain);
/*  904 */       targetName = ((DynamicGroup)grantedOnTarget).getName();
/*  905 */       break;
/*      */     case domain: 
/*  907 */       grantedOnTarget = domain;
/*  908 */       targetName = domain.getName();
/*  909 */       break;
/*      */     case server: 
/*  911 */       grantedOnTarget = createServer();
/*  912 */       targetName = ((Server)grantedOnTarget).getName();
/*  913 */       break;
/*      */     case alwaysoncluster: 
/*  915 */       grantedOnTarget = createAlwaysOnCluster();
/*  916 */       targetName = ((AlwaysOnCluster)grantedOnTarget).getName();
/*  917 */       break;
/*      */     case ucservice: 
/*  919 */       grantedOnTarget = createUCService();
/*  920 */       targetName = ((UCService)grantedOnTarget).getName();
/*  921 */       break;
/*      */     
/*      */     case xmppcomponent: 
/*  924 */       return;
/*      */     case zimlet: 
/*  926 */       grantedOnTarget = createZimlet();
/*  927 */       targetName = ((Zimlet)grantedOnTarget).getName();
/*  928 */       break;
/*      */     case config: 
/*  930 */       grantedOnTarget = getConfig();
/*  931 */       break;
/*      */     case global: 
/*  933 */       grantedOnTarget = getGlobalGrant();
/*  934 */       break;
/*      */     default: 
/*  936 */       Assert.fail();
/*      */     }
/*      */     
/*      */     
/*      */ 
/*      */ 
/*  942 */     boolean gotInvalidRequestException = false;
/*      */     
/*      */ 
/*      */     try
/*      */     {
/*  947 */       Account grantingAccount = globalAdmin;
/*      */       
/*  949 */       RightCommand.grantRight(prov, grantingAccount, grantedOnTargetType.getCode(), TargetBy.name, targetName, granteeType.getCode(), GranteeSelector.GranteeBy.name, granteeName, secret, right.getName(), null);
/*      */ 
/*      */ 
/*      */     }
/*      */     catch (ServiceException e)
/*      */     {
/*      */ 
/*  956 */       if ("service.INVALID_REQUEST".equals(e.getCode())) {
/*  957 */         gotInvalidRequestException = true;
/*      */       } else {
/*  959 */         e.printStackTrace();
/*  960 */         Assert.fail();
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*  967 */     Assert.assertEquals(Boolean.valueOf(expectInvalidRequest), Boolean.valueOf(gotInvalidRequestException));
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  977 */     if ((grantedOnTarget instanceof Group)) {
/*  978 */       grantedOnTarget = prov.getGroupBasic(Key.DistributionListBy.id, ((Group)grantedOnTarget).getId());
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  985 */     if (right.isComboRight()) {
/*  986 */       for (Right rt : ((ComboRight)right).getAllRights()) {
/*  987 */         setupTargetAndVerify(domain, grantedOnTarget, grantedOnTargetType, rt, true, allowedAccts, deniedAccts, !gotInvalidRequestException);
/*      */       }
/*      */       
/*      */     }
/*      */     else {
/*  992 */       setupTargetAndVerify(domain, grantedOnTarget, grantedOnTargetType, right, false, allowedAccts, deniedAccts, !gotInvalidRequestException);
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private boolean canGrantBeInheritedForCreate(Entry grantedOnTarget, Entry target)
/*      */     throws Exception
/*      */   {
/* 1004 */     TargetType targetType = TargetType.getTargetType(target);
/* 1005 */     TargetType grantedOnTargetType = TargetType.getTargetType(grantedOnTarget);
/*      */     
/* 1007 */     Set<TargetType> inheritableTypes = Sets.newHashSet();
/* 1008 */     switch (targetType) {
/*      */     case account: 
/* 1010 */       inheritableTypes.add(TargetType.domain);
/* 1011 */       inheritableTypes.add(TargetType.global);
/* 1012 */       break;
/*      */     case calresource: 
/* 1014 */       inheritableTypes.add(TargetType.domain);
/* 1015 */       inheritableTypes.add(TargetType.global);
/* 1016 */       break;
/*      */     case cos: 
/* 1018 */       inheritableTypes.add(TargetType.global);
/* 1019 */       break;
/*      */     case dl: 
/* 1021 */       inheritableTypes.add(TargetType.domain);
/* 1022 */       inheritableTypes.add(TargetType.global);
/* 1023 */       break;
/*      */     case group: 
/* 1025 */       inheritableTypes.add(TargetType.domain);
/* 1026 */       inheritableTypes.add(TargetType.global);
/* 1027 */       break;
/*      */     case domain: 
/* 1029 */       inheritableTypes.add(TargetType.global);
/* 1030 */       break;
/*      */     case server: 
/* 1032 */       inheritableTypes.add(TargetType.global);
/* 1033 */       break;
/*      */     case alwaysoncluster: 
/* 1035 */       inheritableTypes.add(TargetType.global);
/* 1036 */       break;
/*      */     case ucservice: 
/* 1038 */       inheritableTypes.add(TargetType.global);
/* 1039 */       break;
/*      */     case xmppcomponent: 
/* 1041 */       inheritableTypes.add(TargetType.global);
/* 1042 */       break;
/*      */     case zimlet: 
/* 1044 */       inheritableTypes.add(TargetType.global);
/* 1045 */       break;
/*      */     case config: 
/* 1047 */       inheritableTypes.add(TargetType.global);
/* 1048 */       break;
/*      */     case global: 
/*      */       break;
/*      */     default: 
/* 1052 */       Assert.fail();
/*      */     }
/* 1054 */     return inheritableTypes.contains(grantedOnTargetType);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private void setupTargetAndVerify(Domain domain, Entry grantedOnTarget, TargetType grantedOnTargetType, Right right, boolean fromComboRight, List<Account> allowedAccts, List<Account> deniedAccts, boolean grantWasValid)
/*      */     throws Exception
/*      */   {
/* 1064 */     List<Entry> goodTargets = Lists.newArrayList();
/* 1065 */     List<Entry> badTargets = Lists.newArrayList();
/*      */     
/* 1067 */     if (right.isPresetRight()) {
/* 1068 */       TargetType targetTypeOfRight = right.getTargetType();
/* 1069 */       setupTarget(goodTargets, badTargets, domain, grantedOnTarget, grantedOnTargetType, targetTypeOfRight, right);
/*      */     }
/* 1071 */     else if (right.isAttrRight()) {
/* 1072 */       for (TargetType targetTypeOfRight : ((AttrRight)right).getTargetTypes()) {
/* 1073 */         setupTarget(goodTargets, badTargets, domain, grantedOnTarget, grantedOnTargetType, targetTypeOfRight, right);
/*      */       }
/*      */     }
/*      */     else {
/* 1077 */       Assert.fail();
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1084 */     for (Entry goodTarget : goodTargets) {
/* 1085 */       boolean canGrantBeInheritedForCreate = canGrantBeInheritedForCreate(grantedOnTarget, goodTarget);
/* 1086 */       verify(goodTarget, canGrantBeInheritedForCreate, allowedAccts, deniedAccts, right, fromComboRight, grantWasValid);
/*      */     }
/* 1088 */     for (Entry badTarget : badTargets) {
/* 1089 */       boolean canGrantBeInheritedForCreate = canGrantBeInheritedForCreate(grantedOnTarget, badTarget);
/* 1090 */       verify(badTarget, canGrantBeInheritedForCreate, allowedAccts, deniedAccts, right, fromComboRight, false);
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   private void setupTarget(List<Entry> goodTargets, List<Entry> badTargets, Domain domain, Entry grantedOnTarget, TargetType grantedOnTargetType, TargetType targetTypeOfRight, Right right)
/*      */     throws Exception
/*      */   {
/* 1098 */     Entry good = null;
/* 1099 */     Entry bad = null;
/*      */     
/* 1101 */     switch (targetTypeOfRight) {
/*      */     case account: 
/* 1103 */       if (grantedOnTargetType == TargetType.account) {
/* 1104 */         goodTargets.add(grantedOnTarget);
/* 1105 */         badTargets.add(createUserAccount(domain));
/*      */       }
/* 1107 */       else if (grantedOnTargetType == TargetType.calresource) {
/* 1108 */         if (right.isUserRight()) {
/* 1109 */           goodTargets.add(grantedOnTarget);
/* 1110 */           badTargets.add(createCalendarResource(domain));
/*      */         } else {
/* 1112 */           badTargets.add(grantedOnTarget);
/*      */         }
/*      */       }
/* 1115 */       else if (grantedOnTargetType == TargetType.dl) {
/* 1116 */         if (CheckRight.allowGroupTarget(right)) {
/* 1117 */           good = createUserAccount(domain);
/* 1118 */           goodTargets.add(good);
/*      */           
/*      */ 
/* 1121 */           DistributionList subGroup = createUserDistributionList(domain);
/* 1122 */           prov.addMembers((DistributionList)grantedOnTarget, new String[] { subGroup.getName() });
/* 1123 */           prov.addMembers(subGroup, new String[] { ((Account)good).getName() });
/*      */         } else {
/* 1125 */           bad = createUserAccount(domain);
/* 1126 */           prov.addMembers((DistributionList)grantedOnTarget, new String[] { ((Account)bad).getName() });
/* 1127 */           badTargets.add(bad);
/*      */         }
/*      */       }
/* 1130 */       else if (grantedOnTargetType == TargetType.group) {
/* 1131 */         if (CheckRight.allowGroupTarget(right)) {
/* 1132 */           good = createUserAccount(domain);
/* 1133 */           prov.addGroupMembers((DynamicGroup)grantedOnTarget, new String[] { ((Account)good).getName() });
/* 1134 */           goodTargets.add(good);
/*      */         } else {
/* 1136 */           bad = createUserAccount(domain);
/* 1137 */           prov.addGroupMembers((DynamicGroup)grantedOnTarget, new String[] { ((Account)bad).getName() });
/* 1138 */           badTargets.add(bad);
/*      */         }
/*      */       }
/* 1141 */       else if (grantedOnTargetType == TargetType.domain) {
/* 1142 */         goodTargets.add(createUserAccount(domain));
/*      */         
/* 1144 */         Domain anyDomain = createDomain();
/* 1145 */         badTargets.add(createUserAccount(anyDomain));
/*      */       }
/* 1147 */       else if (grantedOnTargetType == TargetType.global) {
/* 1148 */         Domain anyDomain = createDomain();
/* 1149 */         goodTargets.add(createUserAccount(anyDomain));
/*      */       }
/*      */       else {
/* 1152 */         badTargets.add(grantedOnTarget);
/*      */       }
/*      */       
/* 1155 */       break;
/*      */     case calresource: 
/* 1157 */       if (grantedOnTargetType == TargetType.calresource) {
/* 1158 */         goodTargets.add(grantedOnTarget);
/* 1159 */         badTargets.add(createCalendarResource(domain));
/*      */       }
/* 1161 */       else if (grantedOnTargetType == TargetType.dl) {
/* 1162 */         if (CheckRight.allowGroupTarget(right)) {
/* 1163 */           good = createCalendarResource(domain);
/* 1164 */           prov.addMembers((DistributionList)grantedOnTarget, new String[] { ((Account)good).getName() });
/* 1165 */           goodTargets.add(good);
/*      */         } else {
/* 1167 */           bad = createCalendarResource(domain);
/* 1168 */           prov.addMembers((DistributionList)grantedOnTarget, new String[] { ((Account)bad).getName() });
/* 1169 */           badTargets.add(bad);
/*      */         }
/*      */       }
/* 1172 */       else if (grantedOnTargetType == TargetType.group) {
/* 1173 */         if (CheckRight.allowGroupTarget(right)) {
/* 1174 */           good = createCalendarResource(domain);
/* 1175 */           prov.addGroupMembers((DynamicGroup)grantedOnTarget, new String[] { ((Account)good).getName() });
/* 1176 */           goodTargets.add(good);
/*      */         } else {
/* 1178 */           bad = createCalendarResource(domain);
/* 1179 */           prov.addGroupMembers((DynamicGroup)grantedOnTarget, new String[] { ((Account)bad).getName() });
/* 1180 */           badTargets.add(bad);
/*      */         }
/*      */       }
/* 1183 */       else if (grantedOnTargetType == TargetType.domain) {
/* 1184 */         good = createCalendarResource(domain);
/* 1185 */         goodTargets.add(good);
/*      */         
/* 1187 */         Domain anyDomain = createDomain();
/* 1188 */         bad = createUserAccount(anyDomain);
/* 1189 */         badTargets.add(bad);
/*      */       }
/* 1191 */       else if (grantedOnTargetType == TargetType.global) {
/* 1192 */         Domain anyDomain = createDomain();
/* 1193 */         goodTargets.add(createCalendarResource(anyDomain));
/*      */       } else {
/* 1195 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1197 */       break;
/*      */     case cos: 
/* 1199 */       if (grantedOnTargetType == TargetType.cos) {
/* 1200 */         good = grantedOnTarget;
/* 1201 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1202 */         good = createCos();
/*      */       }
/*      */       
/* 1205 */       if (good == null) {
/* 1206 */         bad = grantedOnTarget;
/* 1207 */         badTargets.add(bad);
/*      */       } else {
/* 1209 */         goodTargets.add(good);
/*      */       }
/* 1211 */       break;
/*      */     case dl: 
/* 1213 */       if (grantedOnTargetType == TargetType.dl)
/*      */       {
/* 1215 */         DistributionList subGroup = createUserDistributionList(domain);
/* 1216 */         prov.addMembers((DistributionList)grantedOnTarget, new String[] { subGroup.getName() });
/*      */         
/* 1218 */         goodTargets.add(subGroup);
/* 1219 */         goodTargets.add(grantedOnTarget);
/* 1220 */         badTargets.add(createUserDistributionList(domain));
/*      */       }
/* 1222 */       else if (grantedOnTargetType == TargetType.group)
/*      */       {
/* 1224 */         if (right.isUserRight()) {
/* 1225 */           goodTargets.add(grantedOnTarget);
/*      */         } else {
/* 1227 */           badTargets.add(grantedOnTarget);
/*      */         }
/*      */       }
/* 1230 */       else if (grantedOnTargetType == TargetType.domain) {
/* 1231 */         goodTargets.add(createUserDistributionList(domain));
/*      */         
/* 1233 */         if (right.isUserRight()) {
/* 1234 */           goodTargets.add(createUserDynamicGroup(domain));
/*      */         } else {
/* 1236 */           badTargets.add(createUserDynamicGroup(domain));
/*      */         }
/*      */         
/* 1239 */         Domain anyDomain = createDomain();
/* 1240 */         badTargets.add(createUserDistributionList(anyDomain));
/* 1241 */         badTargets.add(createUserDynamicGroup(anyDomain));
/*      */       }
/* 1243 */       else if (grantedOnTargetType == TargetType.global) {
/* 1244 */         Domain anyDomain = createDomain();
/* 1245 */         goodTargets.add(createUserDistributionList(anyDomain));
/*      */         
/* 1247 */         if (right.isUserRight()) {
/* 1248 */           goodTargets.add(createUserDynamicGroup(anyDomain));
/*      */         } else {
/* 1250 */           badTargets.add(createUserDynamicGroup(anyDomain));
/*      */         }
/*      */       }
/*      */       else {
/* 1254 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1256 */       break;
/*      */     case group: 
/* 1258 */       if (grantedOnTargetType == TargetType.dl) {
/* 1259 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1261 */       else if (grantedOnTargetType == TargetType.group) {
/* 1262 */         goodTargets.add(grantedOnTarget);
/*      */       }
/* 1264 */       else if (grantedOnTargetType == TargetType.domain) {
/* 1265 */         goodTargets.add(createUserDynamicGroup(domain));
/* 1266 */         badTargets.add(createUserDistributionList(domain));
/*      */         
/* 1268 */         Domain anyDomain = createDomain();
/* 1269 */         badTargets.add(createUserDistributionList(anyDomain));
/* 1270 */         badTargets.add(createUserDynamicGroup(anyDomain));
/*      */       }
/* 1272 */       else if (grantedOnTargetType == TargetType.global) {
/* 1273 */         Domain anyDomain = createDomain();
/* 1274 */         goodTargets.add(createUserDynamicGroup(anyDomain));
/* 1275 */         badTargets.add(createUserDistributionList(anyDomain));
/*      */       }
/*      */       else {
/* 1278 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1280 */       break;
/*      */     case domain: 
/* 1282 */       if (grantedOnTargetType == TargetType.domain) {
/* 1283 */         goodTargets.add(grantedOnTarget);
/* 1284 */         badTargets.add(createDomain());
/* 1285 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1286 */         goodTargets.add(createDomain());
/*      */       } else {
/* 1288 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1290 */       break;
/*      */     case server: 
/* 1292 */       if (grantedOnTargetType == TargetType.server) {
/* 1293 */         goodTargets.add(grantedOnTarget);
/* 1294 */         badTargets.add(createServer());
/* 1295 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1296 */         goodTargets.add(createServer());
/*      */       } else {
/* 1298 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1300 */       break;
/*      */     case alwaysoncluster: 
/* 1302 */       if (grantedOnTargetType == TargetType.alwaysoncluster) {
/* 1303 */         goodTargets.add(grantedOnTarget);
/* 1304 */         badTargets.add(createAlwaysOnCluster());
/* 1305 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1306 */         goodTargets.add(createAlwaysOnCluster());
/*      */       } else {
/* 1308 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1310 */       break;
/*      */     case ucservice: 
/* 1312 */       if (grantedOnTargetType == TargetType.ucservice) {
/* 1313 */         goodTargets.add(grantedOnTarget);
/* 1314 */         badTargets.add(createUCService());
/* 1315 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1316 */         goodTargets.add(createUCService());
/*      */       } else {
/* 1318 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1320 */       break;
/*      */     
/*      */ 
/*      */     case xmppcomponent: 
/*      */       
/*      */     
/*      */ 
/*      */     case zimlet: 
/* 1328 */       prov.reload(grantedOnTarget);
/*      */       
/* 1330 */       if (grantedOnTargetType == TargetType.zimlet) {
/* 1331 */         goodTargets.add(grantedOnTarget);
/* 1332 */         badTargets.add(createZimlet());
/* 1333 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1334 */         goodTargets.add(createZimlet());
/*      */       } else {
/* 1336 */         badTargets.add(grantedOnTarget);
/*      */       }
/* 1338 */       break;
/*      */     case config: 
/* 1340 */       if (grantedOnTargetType == TargetType.config) {
/* 1341 */         goodTargets.add(grantedOnTarget);
/* 1342 */       } else if (grantedOnTargetType == TargetType.global) {
/* 1343 */         goodTargets.add(getConfig());
/*      */       } else
/* 1345 */         badTargets.add(grantedOnTarget);
/* 1346 */       break;
/*      */     case global: 
/* 1348 */       if (grantedOnTargetType == TargetType.global) {
/* 1349 */         goodTargets.add(getGlobalGrant());
/*      */       } else
/* 1351 */         badTargets.add(grantedOnTarget);
/* 1352 */       break;
/*      */     default: 
/* 1354 */       Assert.fail();
/*      */     }
/*      */   }
/*      */   
/*      */   private RightCommand.EffectiveRights getEffectiveRights(Account grantee, Entry target) {
/* 1359 */     RightCommand.EffectiveRights effRights = null;
/* 1360 */     boolean expectFailure = !grantee.isIsDelegatedAdminAccount();
/*      */     try {
/* 1362 */       effRights = RightCommand.getEffectiveRights(prov, TargetType.getTargetType(target).getCode(), TargetBy.name, target.getLabel(), GranteeSelector.GranteeBy.name, grantee.getName(), false, false);
/*      */ 
/*      */ 
/*      */ 
/*      */     }
/*      */     catch (ServiceException e)
/*      */     {
/*      */ 
/*      */ 
/* 1371 */       if (!expectFailure) {
/* 1372 */         e.printStackTrace();
/* 1373 */         Assert.fail();
/*      */       }
/*      */     }
/*      */     
/* 1377 */     if (expectFailure) {
/* 1378 */       Assert.assertNull(effRights);
/*      */     } else {
/* 1380 */       Assert.assertNotNull(effRights);
/*      */     }
/* 1382 */     return effRights;
/*      */   }
/*      */   
/*      */   private RightCommand.AllEffectiveRights getAllEffectiveRights(Account grantee) {
/* 1386 */     RightCommand.AllEffectiveRights allEffRights = null;
/* 1387 */     boolean expectFailure = !grantee.isIsDelegatedAdminAccount();
/*      */     try {
/* 1389 */       allEffRights = RightCommand.getAllEffectiveRights(prov, GranteeType.GT_USER.getCode(), GranteeSelector.GranteeBy.name, grantee.getName(), false, false);
/*      */ 
/*      */ 
/*      */     }
/*      */     catch (ServiceException e)
/*      */     {
/*      */ 
/* 1396 */       if (!expectFailure) {
/* 1397 */         e.printStackTrace();
/* 1398 */         Assert.fail();
/*      */       }
/*      */     }
/*      */     
/* 1402 */     if (expectFailure) {
/* 1403 */       Assert.assertNull(allEffRights);
/*      */     } else {
/* 1405 */       Assert.assertNotNull(allEffRights);
/*      */     }
/* 1407 */     return allEffRights;
/*      */   }
/*      */   
/*      */   private RightCommand.EffectiveRights getCreateObjectAttrs(Account grantee, Entry target) {
/* 1411 */     RightCommand.EffectiveRights effRights = null;
/* 1412 */     boolean expectFailure = false;
/*      */     try
/*      */     {
/* 1415 */       String domainName = TargetType.getTargetDomainName(prov, target);
/* 1416 */       TargetType targetType = TargetType.getTargetType(target);
/*      */       
/* 1418 */       expectFailure = (!grantee.isIsDelegatedAdminAccount()) || (targetType == TargetType.config) || (targetType == TargetType.global);
/*      */       
/*      */ 
/*      */ 
/* 1422 */       effRights = RightCommand.getCreateObjectAttrs(prov, TargetType.getTargetType(target).getCode(), Key.DomainBy.name, domainName, null, null, GranteeSelector.GranteeBy.name, grantee.getName());
/*      */ 
/*      */ 
/*      */     }
/*      */     catch (ServiceException e)
/*      */     {
/*      */ 
/*      */ 
/* 1430 */       if (!expectFailure) {
/* 1431 */         e.printStackTrace();
/* 1432 */         Assert.fail();
/*      */       }
/*      */     }
/*      */     
/* 1436 */     if (expectFailure) {
/* 1437 */       Assert.assertNull(effRights);
/*      */     } else {
/* 1439 */       Assert.assertNotNull(effRights);
/*      */     }
/* 1441 */     return effRights;
/*      */   }
/*      */   
/*      */   private boolean isPresetRightInEffectiveRights(RightCommand.EffectiveRights effRights, Right right) {
/* 1445 */     return effRights.presetRights().contains(right.getName());
/*      */   }
/*      */   
/*      */ 
/*      */   private boolean isAttrRightInEffectiveRights(RightCommand.EffectiveRights effRights, Right.RightType rightType, boolean allAttrs, Set<String> attrs)
/*      */   {
/* 1451 */     boolean found = false;
/*      */     
/* 1453 */     if (rightType == Right.RightType.getAttrs) {
/* 1454 */       if (allAttrs) {
/* 1455 */         found = effRights.canGetAllAttrs();
/*      */       } else {
/* 1457 */         Set<String> allowedAttrs = effRights.canGetAttrs().keySet();
/* 1458 */         found = allowedAttrs.containsAll(attrs);
/*      */       }
/* 1460 */     } else if (rightType == Right.RightType.setAttrs) {
/* 1461 */       if (allAttrs) {
/* 1462 */         found = effRights.canSetAllAttrs();
/*      */       } else {
/* 1464 */         Set<String> allowedAttrs = effRights.canSetAttrs().keySet();
/* 1465 */         found = allowedAttrs.containsAll(attrs);
/*      */       }
/*      */     } else {
/* 1468 */       Assert.fail();
/*      */     }
/* 1470 */     return found;
/*      */   }
/*      */   
/*      */   private boolean isRightInEffectiveRights(RightCommand.EffectiveRights effRights, Right right, Right.RightType rightType, boolean allAttrs, Set<String> attrs)
/*      */   {
/* 1475 */     boolean found = false;
/* 1476 */     if (right.isPresetRight()) {
/* 1477 */       found = isPresetRightInEffectiveRights(effRights, right);
/* 1478 */     } else if (right.isAttrRight()) {
/* 1479 */       AttrRight attrRight = (AttrRight)right;
/* 1480 */       found = isAttrRightInEffectiveRights(effRights, rightType, allAttrs, attrs);
/*      */     }
/*      */     else {
/* 1483 */       Assert.fail();
/*      */     }
/* 1485 */     return found;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private boolean isRightInRightAggregation(RightCommand.RightAggregation rightAggr, boolean domainScope, Entry target, Right right, Right.RightType rightType, boolean allAttrs, Set<String> attrs)
/*      */   {
/* 1506 */     RightCommand.EffectiveRights effRights = rightAggr.effectiveRights();
/*      */     
/* 1508 */     for (String entry : rightAggr.entries()) {
/* 1509 */       boolean matchTarget = false;
/* 1510 */       if (domainScope) {
/* 1511 */         Domain domain = null;
/*      */         try {
/* 1513 */           domain = TargetType.getTargetDomain(prov, target);
/*      */         } catch (ServiceException e) {
/* 1515 */           e.printStackTrace();
/* 1516 */           Assert.fail();
/*      */         }
/* 1518 */         Assert.assertNotNull(domain);
/* 1519 */         matchTarget = entry.equals(domain.getName());
/*      */       } else {
/* 1521 */         matchTarget = entry.equals(target.getLabel());
/*      */       }
/*      */       
/* 1524 */       if (matchTarget)
/*      */       {
/*      */ 
/*      */ 
/* 1528 */         boolean found = isRightInEffectiveRights(effRights, right, rightType, allAttrs, attrs);
/*      */         
/*      */ 
/* 1531 */         if (found)
/* 1532 */           return true;
/*      */       }
/*      */     }
/* 1535 */     return false;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */   private boolean isRightInGetAllEffectiveRights(RightCommand.AllEffectiveRights allEffRights, Account grantee, Entry target, Right right, Right.RightType rightType, boolean allAttrs, Set<String> attrs)
/*      */     throws ServiceException
/*      */   {
/* 1543 */     TargetType targetType = TargetType.getTargetType(target);
/*      */     
/* 1545 */     Map<TargetType, RightCommand.RightsByTargetType> rbttMap = allEffRights.rightsByTargetType();
/* 1546 */     RightCommand.RightsByTargetType rbtt = (RightCommand.RightsByTargetType)rbttMap.get(targetType);
/*      */     boolean found;
/* 1548 */     if (rbtt != null) {
/* 1549 */       found = false;
/*      */       
/*      */ 
/* 1552 */       RightCommand.EffectiveRights effRights = rbtt.all();
/* 1553 */       if (effRights != null) {
/* 1554 */         found = isRightInEffectiveRights(effRights, right, rightType, allAttrs, attrs);
/*      */         
/* 1556 */         if (found) {
/* 1557 */           return true;
/*      */         }
/*      */       }
/*      */       
/*      */ 
/* 1562 */       if ((rbtt instanceof RightCommand.DomainedRightsByTargetType)) {
/* 1563 */         RightCommand.DomainedRightsByTargetType domainedRights = (RightCommand.DomainedRightsByTargetType)rbtt;
/*      */         
/* 1565 */         for (RightCommand.RightAggregation rightsByDomains : domainedRights.domains()) {
/* 1566 */           found = isRightInRightAggregation(rightsByDomains, true, target, right, rightType, allAttrs, attrs);
/*      */           
/* 1568 */           if (found) {
/* 1569 */             return true;
/*      */           }
/*      */         }
/*      */       }
/*      */       
/*      */ 
/* 1575 */       for (RightCommand.RightAggregation rightsByEntries : rbtt.entries()) {
/* 1576 */         found = isRightInRightAggregation(rightsByEntries, false, target, right, rightType, allAttrs, attrs);
/*      */         
/* 1578 */         if (found) {
/* 1579 */           return true;
/*      */         }
/*      */       }
/*      */     }
/* 1583 */     return false;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private void verifyPresetRight(Account grantee, Entry target, Right right, boolean expectedResult)
/*      */     throws ServiceException
/*      */   {
/* 1593 */     boolean allow = false;
/*      */     try {
/* 1595 */       allow = accessMgr.canDo(grantee, target, right, asAdmin(grantee), null);
/*      */     }
/*      */     catch (ServiceException e) {
/* 1598 */       if (!"service.PERM_DENIED".equals(e.getCode())) {
/* 1599 */         Assert.fail();
/*      */       }
/*      */     }
/* 1602 */     Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1607 */     RightCommand.EffectiveRights effRights = getEffectiveRights(grantee, target);
/* 1608 */     if (effRights != null) {
/* 1609 */       allow = isPresetRightInEffectiveRights(effRights, right);
/* 1610 */       Assert.assertEquals(Boolean.valueOf((expectedResult) && (!right.isUserRight())), Boolean.valueOf(allow));
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1616 */     RightCommand.AllEffectiveRights allEffRights = getAllEffectiveRights(grantee);
/* 1617 */     if (allEffRights != null) {
/* 1618 */       allow = isRightInGetAllEffectiveRights(allEffRights, grantee, target, right, null, false, null);
/*      */       
/* 1620 */       Assert.assertEquals(Boolean.valueOf((expectedResult) && (!right.isUserRight())), Boolean.valueOf(allow));
/*      */     }
/*      */   }
/*      */   
/*      */   private void verifyGetAttrs(Account grantee, Entry target, AttrRight attrRight, boolean canGrantBeInheritedForCreate, Set<String> attrs, boolean expectedResult)
/*      */     throws ServiceException
/*      */   {
/* 1627 */     boolean allow = false;
/*      */     
/*      */ 
/*      */ 
/*      */     try
/*      */     {
/* 1633 */       allow = accessMgr.canGetAttrs(grantee, target, attrs, true);
/*      */     }
/*      */     catch (ServiceException e) {
/* 1636 */       if (!"service.PERM_DENIED".equals(e.getCode())) {
/* 1637 */         e.printStackTrace();
/* 1638 */         Assert.fail();
/*      */       }
/*      */     }
/* 1641 */     Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1646 */     RightCommand.EffectiveRights effRights = getEffectiveRights(grantee, target);
/* 1647 */     if (effRights != null) {
/* 1648 */       allow = isAttrRightInEffectiveRights(effRights, Right.RightType.getAttrs, attrRight.allAttrs(), attrs);
/*      */       
/* 1650 */       Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1656 */     RightCommand.AllEffectiveRights allEffRights = getAllEffectiveRights(grantee);
/* 1657 */     if (allEffRights != null) {
/* 1658 */       allow = isRightInGetAllEffectiveRights(allEffRights, grantee, target, attrRight, Right.RightType.getAttrs, attrRight.allAttrs(), attrs);
/*      */       
/*      */ 
/* 1661 */       Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1667 */     RightCommand.EffectiveRights effRightsCreate = getCreateObjectAttrs(grantee, target);
/* 1668 */     if (effRightsCreate != null)
/*      */     {
/*      */ 
/*      */ 
/*      */ 
/* 1673 */       allow = isAttrRightInEffectiveRights(effRightsCreate, Right.RightType.getAttrs, attrRight.allAttrs(), attrs);
/*      */       
/* 1675 */       Assert.assertEquals(Boolean.valueOf((expectedResult) && (canGrantBeInheritedForCreate)), Boolean.valueOf(allow));
/*      */     }
/*      */   }
/*      */   
/*      */   private void verifySetAttrs(Account grantee, Entry target, AttrRight attrRight, boolean canGrantBeInheritedForCreate, Set<String> attrs, boolean expectedResult)
/*      */     throws ServiceException
/*      */   {
/* 1682 */     boolean allow = false;
/*      */     
/*      */ 
/*      */ 
/*      */     try
/*      */     {
/* 1688 */       allow = accessMgr.canSetAttrs(grantee, target, attrs, true);
/*      */     }
/*      */     catch (ServiceException e) {
/* 1691 */       if (!"service.PERM_DENIED".equals(e.getCode())) {
/* 1692 */         Assert.fail();
/*      */       }
/*      */     }
/* 1695 */     Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1700 */     RightCommand.EffectiveRights effRights = getEffectiveRights(grantee, target);
/* 1701 */     if (effRights != null) {
/* 1702 */       allow = isAttrRightInEffectiveRights(effRights, Right.RightType.setAttrs, attrRight.allAttrs(), attrs);
/*      */       
/* 1704 */       Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1710 */     RightCommand.AllEffectiveRights allEffRights = getAllEffectiveRights(grantee);
/* 1711 */     if (allEffRights != null) {
/* 1712 */       allow = isRightInGetAllEffectiveRights(allEffRights, grantee, target, attrRight, Right.RightType.setAttrs, attrRight.allAttrs(), attrs);
/*      */       
/*      */ 
/* 1715 */       Assert.assertEquals(Boolean.valueOf(expectedResult), Boolean.valueOf(allow));
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1721 */     RightCommand.EffectiveRights effRightsCreate = getCreateObjectAttrs(grantee, target);
/* 1722 */     if (effRightsCreate != null)
/*      */     {
/* 1724 */       allow = isAttrRightInEffectiveRights(effRightsCreate, Right.RightType.setAttrs, attrRight.allAttrs(), attrs);
/*      */       
/* 1726 */       Assert.assertEquals(Boolean.valueOf((expectedResult) && (canGrantBeInheritedForCreate)), Boolean.valueOf(allow));
/*      */     }
/*      */   }
/*      */   
/*      */   private void verifyAttrRight(Account grantee, Entry target, AttrRight attrRight, boolean canGrantBeInheritedForCreate, boolean fromComboRight, boolean expectedResult)
/*      */     throws ServiceException
/*      */   {
/* 1733 */     Right.RightType rightType = attrRight.getRightType();
/*      */     
/* 1735 */     Set<String> attrs = attrRight.allAttrs() ? TargetType.getAttrsInClass(target) : Sets.newHashSet(new String[] { "description" });
/*      */     
/*      */ 
/* 1738 */     attrs = Collections.unmodifiableSet(attrs);
/*      */     
/*      */ 
/* 1741 */     verifyGetAttrs(grantee, target, attrRight, canGrantBeInheritedForCreate, attrs, expectedResult);
/*      */     
/*      */ 
/*      */ 
/* 1745 */     if (rightType == Right.RightType.setAttrs) {
/* 1746 */       verifySetAttrs(grantee, target, attrRight, canGrantBeInheritedForCreate, attrs, expectedResult);
/*      */     }
/* 1748 */     else if (rightType == Right.RightType.getAttrs)
/*      */     {
/*      */ 
/* 1751 */       if (!fromComboRight) {
/* 1752 */         verifySetAttrs(grantee, target, attrRight, canGrantBeInheritedForCreate, attrs, false);
/*      */       }
/*      */     }
/*      */     else {
/* 1756 */       Assert.fail();
/*      */     }
/*      */     
/*      */ 
/* 1760 */     if (!attrRight.allAttrs()) {
/* 1761 */       Set<String> badAttrs = Sets.newHashSet(new String[] { "objectClass" });
/* 1762 */       badAttrs = Collections.unmodifiableSet(badAttrs);
/*      */       
/* 1764 */       verifyGetAttrs(grantee, target, attrRight, canGrantBeInheritedForCreate, badAttrs, false);
/* 1765 */       verifySetAttrs(grantee, target, attrRight, canGrantBeInheritedForCreate, badAttrs, false);
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   private void verify(Entry target, boolean canGrantBeInheritedForCreate, List<Account> allowedAccts, List<Account> deniedAccts, Right right, boolean fromComboRight, boolean allowedExpected)
/*      */     throws Exception
/*      */   {
/* 1773 */     if (target == null) {
/* 1774 */       return;
/*      */     }
/*      */     
/* 1777 */     for (Account allowedAcct : allowedAccts)
/*      */     {
/* 1779 */       if (right.isPresetRight()) {
/* 1780 */         verifyPresetRight(allowedAcct, target, right, allowedExpected);
/* 1781 */       } else if (right.isAttrRight()) {
/* 1782 */         verifyAttrRight(allowedAcct, target, (AttrRight)right, canGrantBeInheritedForCreate, fromComboRight, allowedExpected);
/*      */       }
/*      */       else {
/* 1785 */         Assert.fail();
/*      */       }
/*      */     }
/*      */     
/*      */ 
/* 1790 */     for (Account deniedAcct : deniedAccts) {
/* 1791 */       if (right.isPresetRight()) {
/* 1792 */         verifyPresetRight(deniedAcct, target, right, false);
/* 1793 */       } else if (right.isAttrRight()) {
/* 1794 */         verifyAttrRight(deniedAcct, target, (AttrRight)right, canGrantBeInheritedForCreate, fromComboRight, false);
/*      */       }
/*      */       else {
/* 1797 */         Assert.fail();
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */   private static void revokeAllGrantsOnGlobalGrantAndGlobalConfig()
/*      */     throws Exception
/*      */   {
/* 1805 */     RightCommand.Grants grants = RightCommand.getGrants(prov, TargetType.global.getCode(), null, null, null, null, null, false);
/*      */     
/*      */ 
/*      */ 
/* 1809 */     revokeAllGrants(grants);
/*      */     
/* 1811 */     grants = RightCommand.getGrants(prov, TargetType.config.getCode(), null, null, null, null, null, false);
/*      */     
/*      */ 
/*      */ 
/* 1815 */     revokeAllGrants(grants);
/*      */   }
/*      */   
/*      */   private static void revokeAllGrants(RightCommand.Grants grants) throws Exception {
/* 1819 */     for (RightCommand.ACE ace : grants.getACEs()) {
/* 1820 */       RightCommand.revokeRight(prov, globalAdmin, ace.targetType(), TargetBy.id, ace.targetId(), ace.granteeType(), GranteeSelector.GranteeBy.id, ace.granteeId(), ace.right(), ace.rightModifier());
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private void doTest(String note, TargetType grantedOnTargetType, GranteeType granteeType, Right right)
/*      */     throws Exception
/*      */   {
/* 1832 */     doTest(note, grantedOnTargetType, granteeType, right, false);
/*      */   }
/*      */   
/*      */ 
/*      */   private void doTest(String note, TargetType grantedOnTargetType, TestGranteeType granteeType, Right right)
/*      */     throws Exception
/*      */   {
/* 1839 */     doTest(note, grantedOnTargetType, granteeType, right, false);
/*      */   }
/*      */   
/*      */   private void doTest(String note, TargetType grantedOnTargetType, GranteeType granteeType, Right right, boolean skip) throws Exception
/*      */   {
/* 1844 */     TestGranteeType testGranteeType = TestGranteeType.get(granteeType);
/*      */     
/* 1846 */     doTest(note, grantedOnTargetType, testGranteeType, right, skip);
/*      */   }
/*      */   
/*      */   private void doTest(String note, TargetType grantedOnTargetType, TestGranteeType granteeType, Right right, boolean skip) throws Exception
/*      */   {
/*      */     try
/*      */     {
/* 1853 */       if (skip) {
/* 1854 */         skipTest(note, grantedOnTargetType, granteeType, right);
/*      */       } else {
/* 1856 */         execTest(note, grantedOnTargetType, granteeType, right);
/*      */       }
/*      */     } finally {
/* 1859 */       revokeAllGrantsOnGlobalGrantAndGlobalConfig();
/* 1860 */       provUtil.deleteAllEntries();
/*      */     }
/*      */   }
/*      */   
/* 1864 */   private static final Set<String> EXCLUDE_GRANTEE_TYPES = Sets.newHashSet(new String[] { GranteeType.GT_EXT_GROUP.getCode(), GranteeType.GT_EMAIL.getCode() });
/*      */   
/*      */ 
/*      */ 
/*      */   private void testAll()
/*      */     throws Exception
/*      */   {
/* 1871 */     SKIP_FOR_REAL_LDAP_SERVER(ProvTest.SkipTestReason.LONG_TEST);
/*      */     
/* 1873 */     int totalTests = TargetType.values().length * TestGranteeType.TEST_GRANTEE_TYPES.size() * rights.size();
/* 1874 */     int curTest = 1;
/* 1875 */     TargetType targetType; Iterator i$; TestGranteeType granteeType; boolean skip; for (targetType : TargetType.values()) {
/* 1876 */       for (i$ = TestGranteeType.TEST_GRANTEE_TYPES.iterator(); i$.hasNext();) { granteeType = (TestGranteeType)i$.next();
/* 1877 */         skip = EXCLUDE_GRANTEE_TYPES.contains(granteeType.getCode());
/*      */         
/* 1879 */         for (Right right : rights) {
/* 1880 */           doTest(curTest++ + "/" + totalTests, targetType, granteeType, right, skip);
/*      */         }
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   private void testTarget()
/*      */     throws Exception
/*      */   {
/* 1890 */     SKIP_FOR_REAL_LDAP_SERVER(ProvTest.SkipTestReason.LONG_TEST);
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1907 */     TargetType targetType = TargetType.ucservice;
/*      */     
/* 1909 */     int beginRight = 0;
/* 1910 */     int endRight = rights.size() - 1;
/*      */     
/* 1912 */     int totalTests = TestGranteeType.TEST_GRANTEE_TYPES.size() * (endRight - beginRight + 1);
/* 1913 */     int curTest = 1;
/*      */     
/* 1915 */     for (TestGranteeType granteeType : TestGranteeType.TEST_GRANTEE_TYPES) {
/* 1916 */       boolean skip = EXCLUDE_GRANTEE_TYPES.contains(granteeType.getCode());
/*      */       
/*      */ 
/* 1919 */       for (int i = beginRight; i <= endRight; i++) {
/* 1920 */         Right right = (Right)rights.get(i);
/* 1921 */         doTest(curTest++ + "/" + totalTests, targetType, granteeType, right, skip);
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   private void testGrantee()
/*      */     throws Exception
/*      */   {
/* 1930 */     SKIP_FOR_REAL_LDAP_SERVER(ProvTest.SkipTestReason.LONG_TEST);
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1943 */     TestGranteeType granteeType = TestGranteeType.GRANTEE_DYNAMIC_GROUP;
/* 1944 */     int beginRight = 0;
/* 1945 */     int endRight = rights.size() - 1;
/*      */     
/* 1947 */     int totalTests = TargetType.values().length * rights.size();
/* 1948 */     int curTest = 1;
/*      */     TargetType targetType;
/* 1950 */     for (targetType : TargetType.values()) {
/* 1951 */       for (Right right : rights) {
/* 1952 */         doTest(curTest++ + "/" + totalTests, targetType, granteeType, right, false);
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   private void testRight()
/*      */     throws Exception
/*      */   {
/* 1961 */     SKIP_FOR_REAL_LDAP_SERVER(ProvTest.SkipTestReason.LONG_TEST);
/*      */     
/* 1963 */     Right right = ACLTestUtil.ADMIN_COMBO_ACCOUNT;
/*      */     
/* 1965 */     int totalTests = TargetType.values().length * TestGranteeType.TEST_GRANTEE_TYPES.size() * rights.size();
/* 1966 */     int curTest = 1;
/* 1967 */     TargetType targetType; for (targetType : TargetType.values()) {
/* 1968 */       for (TestGranteeType granteeType : TestGranteeType.TEST_GRANTEE_TYPES) {
/* 1969 */         boolean skip = EXCLUDE_GRANTEE_TYPES.contains(granteeType.getCode());
/*      */         
/* 1971 */         doTest(curTest++ + "/" + totalTests, targetType, granteeType, right, skip);
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private void testOne()
/*      */     throws Exception
/*      */   {
/* 2030 */     doTest("1/1", TargetType.ucservice, TestGranteeType.GRANTEE_DYNAMIC_GROUP, ACLTestUtil.USER_LOGIN_AS);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   @Test
/*      */   public void test()
/*      */     throws Exception
/*      */   {
/* 2042 */     Config config = Provisioning.getInstance().getConfig();
/* 2043 */     config.setUCProviderEnabled("mitel");
/*      */     
/*      */ 
/*      */ 
/* 2047 */     testGrantee();
/*      */   }
/*      */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/qa/unittest/prov/ldap/TestACLAll.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */